iOS has two separate systems worth understanding: runtime permission prompts (what happens when an app first tries to access something) and App Store privacy labels (what a developer discloses before you even install).
Permission prompts — the "why" matters
iOS requires apps to request access to sensitive data at the moment they need it, with a system-controlled prompt the app can't skip or fake:
"MyApp" Would Like to Access Your Photos
[Don't Allow] [Allow]
For camera, microphone, and location, iOS goes further and requires apps to explain why they're asking (a string the developer provides, shown directly in the prompt). A photo-editing app asking for photo access is self-explanatory; a flashlight app asking for contacts access is a signal worth pausing on.
The Settings-level permission review
Settings → Privacy & Security lists every permission category (Location Services, Photos, Camera, Microphone, Contacts, etc.) and every app that has access to each — the same "audit by category, not by app" approach that's more useful than checking apps one at a time.
For location specifically, tapping into an app's entry shows options beyond Allow/Never: "Ask Next Time," "While Using the App," and "Always" — and iOS periodically re-surfaces a reminder showing you a map of where an app accessed your location in the background, specifically to make "Always" access visible instead of silent.
App Store privacy labels — what they actually tell you
Every app's App Store listing has a "App Privacy" section, broken into three categories:
- Data Used to Track You — data potentially linked to you and shared with third parties/data brokers for tracking across other companies' apps and websites. This is the category worth the most scrutiny.
- Data Linked to You — data tied to your identity but not used for cross-app tracking.
- Data Not Linked to You — collected but not tied to your identity.
The important caveat: these are self-reported
Privacy labels are filled out by the developer, not independently verified by Apple before publishing. Apple does take enforcement action against apps found to be inaccurate after the fact, but there's no guarantee a label perfectly reflects an app's actual behavior at the moment you're looking at it. Treat labels as a meaningful signal, not a guarantee.
App Tracking Transparency (ATT)
Separate from privacy labels: since iOS 14.5, apps must explicitly ask permission before tracking you across other companies' apps and websites (the system prompt: "Allow [App] to track your activity across other companies' apps and websites?"). Declining this doesn't block the app from functioning — it blocks that specific cross-app tracking use case, most commonly used for targeted advertising.
A practical approach
Before installing an app that seems to want more access than its function justifies, check its App Privacy section on the listing page first — it takes ten seconds and often makes the decision obvious before you've even downloaded it.
